# CVE-2021-47617: linux: In the Linux kernel, the following vulnerability has been resolved:  PCI: pciehp: Fix infinite loop in IRQ handler up...

CVE-2021-47617 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47617, released June 20, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2021-47617
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 20, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  PCI: pciehp: Fix infinite loop in IRQ handler upon power fault  The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky:  It can only be cleared after turning off slot power.  Per PCIe r5.0, sec. 6.7.1.8:    If a power controller detects a main power fault on the hot-plug slot,   it must automatically set its internal main power fault latch [...].   The main power fault latch is cleared when software turns off power to   the hot-plug slot.  The stickiness used to cause interrupt storms and infinite loops which were fixed in 2009 by commits 5651c48cfafe ("PCI pciehp: fix power fault interrupt storm problem") and 99f0169c17f3 ("PCI: pciehp: enable software notification on empty slots").  Unfortunately in 2020 the infinite loop issue was inadvertently reintroduced by commit 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt race"):  The hardirq handler pciehp_isr() clears the PFD bit until pciehp's power_fault_detected flag is set.  That happens in the IRQ thread pciehp_ist(), which never learns of the event because the hardirq handler is stuck in an infinite loop.  Fix by setting the power_fault_detected flag already in the hardirq handler.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.16.7-1 | [DEBIAN-CVE-2021-47617](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47617.md) | Jun 20, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.16.7-1 | [DEBIAN-CVE-2021-47617](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47617.md) | Jun 20, 2024 |
| Linux | linux Debian 14 | 5.16.7-1 | [DEBIAN-CVE-2021-47617](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47617.md) | Jun 20, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.